Dutch companies were hit by a major data leak this week after Nebu, a software company based in Wormerveer, a town located to the north of Amsterdam, suffered a data breach. Nebu specialises in software that allows companies to conduct customer surveys, and the leak has potentially affected the data of at least two million people.
While it’s not yet clear how the data breach occurred, it’s known that the private information gathered in these surveys is stored with Nebu. It’s believed that various Dutch companies used research agencies, which in turn used Nebu’s software to carry out customer satisfaction surveys.
The breach at Nebu has affected Nederlandse Spoorwegen (NS), VodafoneZiggo, ArboNed, Heineken, International Film Festival Rotterdam (IFFR), the Dutch Golf Federation, CZ (a health insurance provider), Trevvel (a company offering transportation for healthcare services), and the Dutch Rental Commission (Huurcommissie).
All companies and organisations affected by the breach are required to inform their customers that their private information has (potentially) been leaked.
The data that has been leaked normally concerns names, email addresses, and phone numbers, but some of the research agencies affected have said they’re not yet sure exactly what data has been leaked.
While there’s minimal cause for concern, as cybercriminals can’t do much with just an email address and phone number, issues could potentially arise if someone is able to connect the data leaked in this breach to other personal data, such as bank account numbers. With this information, scammers might be able to contact individuals with personalised phishing emails, claiming to be from their bank.
At present, the Dutch Data Protection Authority has launched an investigation into the incident, but it’s still unclear what exactly happened. Some of the research agencies affected by the breach have filed summary proceedings against Nebu, calling on the company to provide more information about the leak. The hearing is scheduled to take place on Tuesday, April 4.
